A novel formal theory of concurrent systems is introduced that does not assume any atomic operations. The execution of a concurrent program is modeled as an abstract set of operation executions with two temporal ordering relations: "precedence" and "can causally a#ect". A primitive interprocess communication mechanism is then defined. In Part II, the mutual exclusion is expressed precisely in terms of this model, and solutions using the communication mechanism are given. Contents 1 Introduction 2 2 The Model 2 2.1 Physical Considerations . . . . . . . . . . . . . . . . . . . . . 3 2.2 System Executions . . . . . . . . . . . . . . . . . . . . . . . . 5 2.3 Higher-Level Views . . . . . . . . . . . . . . . . . . . . . . . . 7 3 Interprocess Communication 9 4 Processes 14 5 Multiple-Reader Variables 17 6 Discussion of the Assumptions 18 7 Conclusion 19 1 1 Introduction The mutual exclusion problem was first described and solved by Dijkstra in [3]. In this problem, there is a collection...

Permission is hereby granted to make and distribute verbatim copies of this document without royalty or fee. Permission is granted to quote excerpts from this documented provided the original source is properly cited. ii When separately written programs are composed so that they may cooperate, they may instead destructively interfere in unanticipated ways. These hazards limit the scale and functionality of the software systems we can successfully compose. This dissertation presents a framework for enabling those interactions between components needed for the cooperation we intend, while minimizing the hazards of destructive interference. Great progress on the composition problem has been made within the object paradigm, chiefly in the context of sequential, single-machine programming among benign components. We show how to extend this success to support robust composition of concurrent and potentially malicious components distributed over potentially malicious machines. We present E, a distributed, persistent, secure programming language, and CapDesk, a virus-safe desktop built in E, as embodiments of the techniques we explain.

Traditional message-passing (TMP) is characterized by multiple, individual, point-to-point, typed messages, inducing unintended temporal synchronization. Asynchronous communication can hide some of the overhead and latency from an application, but doing so changes neither the behavior of nor the demands placed upon the communication substrate; messages of the same size are sent at approximately the same times whether synchronous or asynchronous communication is used.